Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

My Splunk > Splunk > Flashcards

Splunk Flashcards

1
Q

Machine data makes up for more than ___% of the data accumulated by organizations.

A

90%

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Machine data is always structured.

A

False

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Machine data is only generated by web servers.

A

False

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What are the three main processing components of Splunk?

A

Forwarders, Search Heads, & Indexers

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Search strings are sent from the _________.

A

Search Heads

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

In most Splunk deployments, ________ serve as the primary way data is supplied for indexing.

A

Forwarders

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Which function is not a part of a single instance deployment?

A

Clustering

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

A single-instance deployment of Splunk Enterprise handles:

A

Indexing Search, Parsing, & Input

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What are the three main default roles in Splunk Enterprise?

A

Admin, User, & Power

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Which apps ship with Splunk Enterprise?

A

Home App & Search & Reporting

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

This role will only see their own knowledge objects and those that have been shared with them.

A

User

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

_________ define what users can do in Splunk.

A

Roles

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

The password for a newly installed Splunk instance is:

A

Created when you install Splunk Enterprise

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Files indexed using the upload input option get indexed _____.

A

Once

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Splunk uses ________ to categorize the type of data being indexed.

A

Sourcetype

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

The monitor input option will allow you to continuously monitor files.

A

True

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Splunk knows where to break the event, where the time stamp is located and how to automatically create field value pairs using these.

A

Source Type

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

In most production environments, _______ will be used as the source of data input.

A

Forwarders

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Events are always returned in chronological order.

A

False

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Which following search mode toggles behavior based on the type of search being run?

A

Smart

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What is the order of evaluation for Boolean operations in Splunk?

A

NOT, OR, & AND

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

When zooming in on the event timeline, a new search is run.

A

False

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Shared search jobs remain active for _______ by default.

A

7 days

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Field names are ________.

A

Case sensitive

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

What attributes describe the circled field below?

A

It contains 4 values and a string value

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Field values are case sensitive

A

False

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Which is not a comparison operator in Splunk?

A

?=

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Wildcards cannot be used with field searches.

A

False

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

What is the most efficient way to filter events in Splunk?

A

By time

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

Time to search can only be set by the time range picker.

A

False

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

As a general practice, exclusion is better than inclusion in a Splunk search.

A

False

32
Q

Having separate indexes allows:

A

Faster searches, ability to limit access and multiple retention policies.

33
Q

This symbol is used in the “Advanced” section of the time range picker to round down to nearest unit of specified time.

A

@

34
Q

What command would you use to remove the status field from the returned events?
Search string:
sourcetype=a* status=404 | _______ status (Last 24 hours)

A

Field

35
Q

Excluding fields using the Fields Command will benefit performance.

A

False

36
Q

What is missing from this search?
Search:
sourcetype=a* | rename IP as “User IP” | table User IP

A

A question mark around User IP.

37
Q

Finish the rename command to change the name of the status field to HTTP Status.

A

Search:
sourcetype=a* status=404 | rename _________

status as “HTPP Status”

38
Q

Would the IP column be removed in the results of this search? Why or why not?

A

No, because the name was changed

39
Q

Which one of these is not a stats function?

A

Addtotals

40
Q

How many results are shown by default when using a Top or Rare Command?

A

10

41
Q

Which stats function would you use to find the average value of a field?

A

Avg

42
Q

Which clause would you use to rename the count field?
Search:
sourcetype=vendor* | stats count __ “Units Sold”

A

As

43
Q

To display the most common values in a specific field, what command would you use?

A

Top

44
Q

A time range picker can be included in a report.

A

True

45
Q

The User role cannot create reports.

A

False

46
Q

Charts can be based on numbers, time, or location.

A

True

47
Q

These roles can create reports:

A

User, Power, & Admin

48
Q

_____________ are reports gathered together into a single pane of glass.

A

Dashboards

49
Q

Pivots cannot be saved as reports panels.

A

False

50
Q

Which role(s) can create data models?

A

Admin & Power

51
Q

These are knowledge objects that provide the data structure for pivot.

A

Data models

52
Q

Pivots can be saved as dashboards panels.

A

True

53
Q

Data models are made up of ___________.

A

Datasets

54
Q

A lookup is categorized as a dataset.

A

True

55
Q

Finish this search command so that it displays data from the http_status.csv Lookup file.

A

Inputlookup
Search:
___ http __status.csv

56
Q

To keep from overwriting existing fields with your Lookup you can use the ____________ clause.

A

Outputnew

57
Q

When using a .csv file for Lookups, the first row in the file represents this.

A

Field names

58
Q

External data used by a Lookup can come from sources like:

A

Geospatial data, scripts, & csv files

59
Q

Alerts can run uploaded scripts.

A

True

60
Q

Once an alert is created, you can no longer edit its defining search.

A

False

61
Q

Alerts can send an email.

A

True

62
Q

Alerts can be shared to all apps.

A

True

63
Q

Real-time alerts will run the search continuously in the background

A

True

64
Q

Which of these is not a main component of Splunk?

A

Compress & archive

65
Q

Which function is not a part of a single instance deployment?

A

Clustering

66
Q

Which apps ship with Splunk Enterprise?

A

Search & reporting & home app

67
Q

You can launch and manage apps from the home app.

A

True

68
Q

This role will only see their own knowledge objects and those that have been shared with them.

A

User

69
Q

Splunk uses ________ to categorize the type of data being indexed.

A

Source types

70
Q

Splunk knows where to break the event, where the time stamp is located and how to automatically create field value pairs using these.

A

Source types

71
Q

Files indexed using the upload input option get indexed _____.

A

Once

72
Q

The time stamp you see in the events is based on the time zone in your user account.

A

True

73
Q

How is the asterisk used in Splunk search?

A

A wildcard

74
Q

Have values in at least 20% of the events.

A

Interesting fields

75
Q

Which command removes results with duplicate field values?

A

Dedup

76
Q

How would you show the top five vendors without showing the percentage field?

A

… | top Vendor limit=5 showperc=f

My Splunk (1 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions